CU Risk Management Plan Discussion

Risk Management Plan
Project Name: Installation of 5G home band and wireless devices
Learner Name: Supratim Dutta
Course Name: PM5334 Project Risk Assess & Control
Date: 01/25/2022
Table of Contents
Risk Management Plan
Section 1 – Introduction to the Plan
1
4
1.1 Benefits of Risk Management
4
1.2 Project Goals and Objectives
5
1.3 Company Background
5
1.4 Risk Identification
6
Risk identification would definitely play a very important role while the risk management has to be taken into consideration. The
different types of risk that visit talking about right now has been mentioned below,
6
1
1.
There are multiple dependencies that have been associated especially with the involvement of external vendors in the market.
2.
All the requirements that would include a lot of scope volatility has been dependent upon the parent program team with the
6
product management would be completely taken the responsibility in order to integrate the Sub products based on the business
requirements.
3.
6
There is a product management team that has been predominantly associated with the waterfall model, the different types of
upstream as well as the downstream systems especially in the other countries would be focusing on the Agile release Management
process which is predominantly making the delivery a bit tough because of the collaboration of two different models.
6
Section 2 – Risk Scope, Components, and Value
6
2.1 Scope of the Risk Management Plan
7
2.2 Risk Management Plan Components
7
2.3 Expected Monetary Value
8
2.4 Determine the Risks
10
2.5 Evaluate and Assess the Risks
11
2.6 Qualitative and Quantitative Processes
12
Section 3 – Risk Analysis and Assessment
19
3.1 Major and Minor Risks
19
3.2 Risk Probability
19
3.3 Risk Matrix Template
24
3.4 Risk Data Quality Strategy
27
2
3.5 Risk Reviews
Section 4 – Corrective Action and Monitoring
27
27
4.1 Risk Tolerance
30
4.2 Risk Mitigation
30
4.3 Corrective Risk Management Strategy
30
4.4 Corrective Action Plan
30
Section 5 – Postmortem Plan
30
5.1 Results
31
5.2 Follow Up
31
6 – References
31
3
Section 1 – Introduction to the Plan
1.1 Benefits of Risk Management
It is really a known fact that the risk management would be playing a very important role in the organization as it will help us to bring
a proper assessment of the respect to risk factors that would be both external as well as internal.
Benefits and risk management
●
Risk management will be generally useful in order to manage the cultural aspect of the business organization where the
focus would be associated in every proactive way in order to have an understanding of the analysis of the risk factors.
●
It will also help in managing the Castro with events where managers would be trying to have a look at all the aspects with
the day-to-day business organization and management.
●
the process will help in enabling the necessary growth where there would be connotations of the respective assumption.
●
having the proper management of risk management in the organization will help him stay competitive.
4
1.2 Project Goals and Objectives
The current project we are talking about right now would be associated with the installation of 5G home band and wireless devices
especially in the markets of the United States of America. The focus has been highly associated with the predominant aspect of
predominantly integrating the organization with respect to elders who would be focusing on the installation process. The installation
process would also be differentiated based on the scope as well as the size of the product.
The objective of the project is to have an installation of 5000 installations especially at the end of the current financial year. The
organization has also been focusing on integrating itself with three different vendors apart from the internal installations of the
organization. This would help to bring in proper revenue especially with the involvement of multiple Saab markets that would include
the customer trial from the commercial as well as the other business Ventures.
1.3 Company Background
Verizon is one of the largest multinational organizations across the globe. It would be focusing on internal as well as external projects
that would be predominantly focusing on telecommunications. We would be talking about an Agile release train right that has its
initial focus on the network Asia as a Project where there would be multiple aspects especially related to the emergency management
as well as 5G fixed wireless customer support which would be focusing on multiple markets in the United States of America.
5
1.4 Risk Identification
Risk identification would definitely play a very important role while the risk management has to be taken into consideration. The
different types of risk that visit talking about right now has been mentioned below,
1. There are multiple dependencies that have been associated especially with the involvement of external vendors in the
market.
2. All the requirements that would include a lot of scope volatility has been dependent upon the parent program team with the
product management would be completely taken the responsibility in order to integrate the Sub products based on the business
requirements.
3. There is a product management team that has been predominantly associated with the waterfall model, the different types
of upstream as well as the downstream systems especially in the other countries would be focusing on the Agile release
Management process which is predominantly making the delivery a bit tough because of the collaboration of two different
models.
Section 2 – Risk Scope, Components, and Value
6
2.1 Scope of the Risk Management Plan
Scope of the risk management plan
The transmission and implementation of 5G can be affected by various risk factors. The scope of this risk management plan
will work to cover the risks defined in this plan along with the appropriate action to take.
The risk management plan will cover supply chain risks associated with the supply and installation of 5G devices. Supply
chain risks are defined as the efforts done by threat actors to exploit information and telecommunication devices for criminal activity,
sabotage, or espionage (Qazi et al., 2018). The desire and popularity that 5G is gaining expose it to supply chain risks such as
counterfeit components, poor maintenance procedures, defects in the manufacturing processes, and malicious software and hardware.
Counterfeit components covered in the risk management plan will include counterfeit components and infrastructure.
The risk management plan will cover subsystem threat vectors. It will ensure that the risks of software configuration
vulnerabilities are addressed. Verizon will constantly monitor network connections to ensure that 5G network connections are secured
properly to avoid destruction or manipulation of critical data.
Some of the best practices that will be implemented include; vetting all vendors and manufacturers to ensure that they are
credible, security systems will constantly be used in monitoring network actions, the standard of supplied devices and infrastructures
cross-checked for authenticity (Srivastava & Rogers, 2021). These best practices will ensure that Verizon saves time by getting
7
reliable devices. It will be able to secure network communication hence improving its reputation, and It will enable the organization to
comply with the government laws and policies.
2.2 Risk Management Plan Components
Components of risk management
●
Identification of the emergency management risk sector
Verizon will need to perform a SWOT analysis to identify internal and external risks effectively. Verizon bears the responsibility
of identifying all risks, including those likely to arise from natural calamities (Kabanda, 2021). The best practice would be to
ensure that places prone to natural calamities like floods are avoided as much as possible during commercial 5G equipment
installation.
● Resources and other things which have been associated to analyze it
After registering the risks in the register, an analysis is done by classifying the impacts of the risk based on its likelihood, impact,
and how vulnerable the organization can get. Verizon is responsible for using a risk matrix to have a reliable visualization of the
risk assessment (Vijayan & Sharma, 2020). A best practice would be for Verizon to check its risk tolerance level and willingness
to accept risks.
8
● Involvement of the necessary stakeholders including the internal as well as the external.
Monitoring of the risks during the project implementation can be done quarterly. The -project manager at Verizon will ensure
that the program cycle reviews are done during the review meetings.
● Involvement of project coordinator along with other risk aspects.
Involvement with the project coordinator will include reporting processes covering directions, effectiveness, accountability,
and supervision in the organization.
Processes Involved in The Risk Management Plan
The first process involved identifying risks through SWOT analysis and brainstorming. The second process is the evaluation
and assessment of potential risks. Communication and collaboration can handle risk assessment and management (Vijayan & Sharma,
2020). The third process is to create responses to the identified risks. Verizon will create a risk response in this phase and decide
whether to accept the risk, mitigate, or transfer. Finally, through the project manager and other risk management team members,
Verizon will continuously monitor risks.
9
2.3 Expected Monetary Value
The identification of the emergency management sector in the involvement of file implementation in the United States of America
can be estimated with 1.5 million dollars of monetary effort because there would be involvement of sectors that have been associated
with different states. The expected monetary cost that has to be afforded for the involvement of other risk factors would be around 2.7
billion dollars. Delay in the project cost due to the involvement of dependency teams from other organizations could cost them 1
billion dollars
The communication process would also be managed by the project management team itself where overall this should be
segregated into high level and low level and medium level. The high-level rest must be immediately prioritized and brought up with a
proper plan as they were the things which would be employed in the team delivery at multiple levels. Medium level and low level this
can be going to the second priority because it would not require immediate importance.
The expected monetary value of the project without risk management will greatly be affected by the probability of the risks and
their impacts. In this case, the project value with an adequate risk management plan is $1.5 Million, while the cost without the risk
management plan is 2.7 billion. Some of the tangible costs arising from the risks include; damage to equipment, buildings,
investments, and infrastructures. Verizon’s intangible costs likely to encounter from the risks include account receivables, service
provision, expenses, and the local communities’ goodwill (Alkinani, et al., 2021).
10
2.4 Determine the Risks
In recent decades, wireless technology has advanced significantly. The 5th Generation of Mobile and Wireless Communications,
often known as 5G, marks a total transformation in mobile networks, allowing users, and apps to meet ever-increasing demands. With
download speeds up to one gigabyte and average rates of 300 Mbps, Verizon 5G Home Internet provides subscribers with ultra-fast
wireless home internet (Dasgupta, Gibson, & Williams, 2021). These blistering home internet rates are achievable because 5G Home
is powered by Verizon 5G Ultra-Wideband (Dasgupta, Gibson, & Williams, 2021). It can deliver reduced latency, more capacity, and
faster speeds than 4G LTE networks. The advantages of a 5G connection are expected to boost business productivity and give
consumers more rapid access to information than ever before. While the benefits of 5G technology are undeniable, its implementation
is fraught with difficulties and threats. Thus, the purpose of this paper is to determine the numerous risks associated with the
installation of 5G home bands and wireless devices and to evaluate and analyze the risks.
5G technology raises several public health concerns. Numerous studies on the health effects of Radiofrequency (RF) radiation
have been undertaken, with mixed results (Bushberg, Chou, Foster, Kavet, Maxson, Tell, & Ziskin, 2020). However, there is little
study on the impact of 5G technology on humans exposed to a higher concentration of RF radiation due to the increasing number of
antennas used. In Canada, RF energy is regulated and governed efficiently. Additionally, Health Canada has established
recommendations for this sort of energy exposure.
For quite some time, Huawei, a well-known Chinese manufacturer of 5G-compatible equipment, has been the target of security
concerns over implementing this technology. Several reports have detected several security holes in Huawei’s firmware and software
11
(Cerdeira, Santos, Fonseca, & Pinto, 2020). Furthermore, Huawei’s Cyber Security Evaluation Centre (CSEC) in the United
Kingdom’s Oversight Board concludes that Huawei’s effort to fix these issues is insufficient (Shoebridge, 2018). Furthermore,
Chinese legislation mandates that businesses work with national intelligence agencies, increasing worries about possible Chinese
government eavesdropping via Huawei’s equipment. As a result, several nations have barred Huawei from their networks, including
Australia, Japan, and the United States. In contrast, the United Kingdom has decided to grant them partial access even though the
national government has not announced its intentions regarding Huawei’s engagement in the construction of Canada’s 5G
infrastructure. The Chinese company’s role in creating 5G equipment poses security concerns in Canada.
2.5 Evaluate and Assess the Risks
Verizon’s 5G network opens the potential for risk management and assessments solutions with more visibility and more specific information into
the network than prior generations. These advanced virtualization capabilities will boost the efficiency of Verizon’s cutting-edge and
comprehensive security risk management practices, which have been used in previous generations and will be enhanced even further with 5G
capabilities. The 5G capabilities include hardware and software vulnerability management processes, security monitoring and response
capabilities, and corporate policies and governance.
Security Operations
Verizon invests heavily in protecting its 5G network against unknown and known risks. This wireless network operator keeps a close eye on
networks to spot threats and respond appropriately. A Security Operations Center monitors the networks to detect any hostile activity. All relevant
12
connections are encrypted to prevent snooping and properly fragmented to prevent an “infection” linked to one piece of equipment from spreading
to the rest of the network. This includes connections between clients and 5G antennae and between various 5G network components.
Verizon uses other preventative measures and methods in addition to technological controls. The concept of least privilege is the first. This is the
practice of granting a user the bare minimum of permissions to conduct activities required for the job function. Secondly is the dual control
technique that entails two or more independent organizations working together to secure critical information or procedures. As a result, no one can
access or utilize the materials. Segregation of duties is another technique. This entails delegating phases to several people to prevent anyone from
tampering with the whole process. Finally, a multiparty authentication approach is used, requiring two or more authentication processes for remote
access.
Verizon uses detective methods such as network Data Loss Prevention and intrusion detection to examine network traffic for unlawful information
transmissions and malware to find issues not addressed by existing measures. Artificial Intelligent (AI) will provide a more efficient approach to
security in the future, allowing for continuous threat monitoring. By incorporating AI into the network’s software-based design, the 5G network
opens up possibilities for its utilization (Javaid, Sher, Nasir, & Guizani, 2018). Through AI skills combined with security automation, large
volumes of data might be swiftly processed for threat detection and mitigation. Verizon’s 5G network will provide more and faster insight into
network activity and the ability to differentiate threats and anomalous network activity, all of which will aid security monitoring and response.
Hardware and Software Vulnerability Management
Vulnerabilities must be addressed as part of 5G security risk management. Verizon has created a sophisticated vulnerability control approach and
acquired hardware and software from trustworthy vendors. Verizon monitors a variety of sources daily to spot patterns that might indicate new
13
vulnerabilities. Vulnerabilities tracking is one indicator of Verizon’s security evaluation, assessment, and resolution performance. According to its
corporate policy, patches and service packs must be administered to Verizon Information Resources in a standardized and prioritized way to
maintain its safety. Since software updates and fixes are more effectively distributed at scale in a software-oriented system than in a predominantly
hardware-based system, software vulnerability assessment shall become more effective as Verizon goes through the Stand Alone 5G transition.
Corporate Governance and Policy
Across Verizon’s network footprint, risk management activities are continuous, including client services and products that may include sensitive
data, internal systems, and networks. Verizon’s Enterprise Information Security Group offers a set of security policies and practices that adhere to
the NIST (National Institute of Standards and Technology) Cybersecurity Framework (Carlton, Levy & Ramim, 2019). Each of the Framework’s
five Core Functions – Define, Protect, Detect, React, and Recover – is represented by an internal, formal corporate-wide policy that establishes the
business processes and personal choices required for security and the standards for Verizon’s infrastructure and supporting applications and
systems. Verizon also maintains several extensive Corporate Information Security Standards, which define the core security controls that must be
in place to support each security instruction.
Verizon reviews and updates these rules and standards on an annual and as-needed basis, considering changing technological capabilities,
regulatory compliance demands, good practices, implementation, and practical experiences. Individual contributor ideas, internal audit results, and
14
organizational units’ audits are all sources of compliance proposals for the Enterprise Information Security Group. Updates are integrated into the
policy after a comprehensive review and approval procedure and delivered to internal stakeholders via Security Management Briefs every month.
Routine inspection, security testing, and uniform installation of the components that make up the corporation’s network are steps in establishing a
safe network foundation. To establish a secure 5G network, a secure setup of network equipment and devices is a fundamental need. As a result,
Verizon’s technical security specialists conduct a pre-launch security risk assessment for both externally and internally branded devices and
applications, putting key 5G features to the test to identify any security problems. The network security team also employs a specialized
professional security testing specialist to analyze essential programs once installed. Outside experts also help the team test 5G user products like
MiFi pucks, 5G home routers, and phones.
First, Verizon evaluates particular possible hazards associated with deploying the application or device using a technique known as threat
modeling. This wireless network operator conducts third-party and internal security checks on-device application layers based on specific threats
to detect attacks that could be utilized on two fronts: the “external threat” from an outside hacker and the “insider threat” from a nefarious insider
(Obaidat, Obeidat, Holst, Al Hayajneh, & Brown, 2020). The conclusions of this security risk assessment will determine whether or not Verizon
has to make any changes before moving forward with the service or product in question. Verizon then collaborates with the system or product
15
provider to verify that any security concerns have been addressed before launch and that the equipment and devices in question have been securely
and properly set up.
Besides industry standards, Verizon develops and publishes specific technical requirements that client equipment manufacturers must follow to
maintain security. These requirements provide smooth connectivity of user equipment and 5G network operations and handle topics not covered
by industry standards, such as securing boot and update utilizing trust and certificate management roots.
2.6 Qualitative and Quantitative Processes
Risk assessment may be required for network security, and one deliverable may be utilized to deal with threats, facilitating the development of a
security plan. In the process of risk assessment, the analytical hierarchy approach is frequently employed as a quantitative and qualitative analysis
tool (Yan, Zhang, Ye & Ren, 2019). The first step in evaluating a system utilizing the analytical hierarchy technique is to create a hierarchical
model. Then, using a hierarchical model, certain unquantifiable and qualitative aspects are quantified, and some quantitative data is generated
through processing and analysis to aid decision-makers.
The traditional Analytical Hierarchy Process (AHP) technique may be broken into four parts for information security risk assessment. The first is
the system’s hierarchical structure model. The goal of this stage is to examine the system’s relevant components. The system is then stratified
according to a set of criteria. The criteria, goal, and scheme layers are generally the three layers that make up the system. A structural judgment
16
matrix is the second phase. The weight of the criterion is calculated using a judgment matrix. Nine-point scales have been proposed to make
comparisons more efficient, as illustrated in the table below.
17
Table 1. The Numerical Scale in AHP Employed in the Paired Comparison (Varatharajan, Manogaran, Priyan, Balaş, & Barna, 2018)
Significance
Description
1
There are two equally vital factors
3
One factor is less essential than the other
5
One factor is more essential than another
7
One factor is strongly essential than another
9
One factor is more essential than another
4, 2, 6, 8
These are choice values that are in the middle
Calculating the weighted value of the single layer is the third stage in this security risk evaluation. It involves calculating the judgment matrix’s
characteristic vector and then normalizing it to obtain the single layer’s weight. The final step is to calculate each layer element’s final
combination weight.
18
In a nutshell, Verizon’s deployment of wireless devices and 5G technology is fraught with dangers and risks. However, the present installation
provides better visibility and precise insights into the network than earlier generations, allowing for risk assessments and management measures.
As a result, the advanced capabilities will improve the efficacy of the network and device’s state-of-the-art and comprehensive risk management
techniques. 5G technology will revolutionize commerce and personal life by bringing a slew of new perks and possibilities.
Section 3 – Risk Analysis and Assessment
Risk assessment may be required for network security, and one deliverable may be utilized to deal with threats, facilitating the development of a
security plan. It is the process of identifying risks that may negatively influence a firm’s capacity to do business. While the benefits of 5G
technology are undeniable, its development and implementation are fraught with several risks. Thus, this paper seeks to determine major and
minor risks associated with installing 5G home bands and wireless devices, determine the probability of the risks, check the risk data quality
strategies and review these risks.
3.1 Major and Minor Risks
Installation of the 5G technology at Verizon company comes with numerous major and minor risks. Quantitative risk
identification and assessment approaches are preferred here because they analyze multiple risk-reduction options through a
comparison of risk before and after adoption, as well as cost-benefit analysis (Van-Western, 2017). The first risk is a larger attack
surface. With millions, if not billions, more devices linked, 5G allows for more significant and hazardous attacks. With 5G, the
19
potential of more advanced privacy breaches, botnets, and speedier data extraction might increase. Notably, if a parameter is not being
used, it is best not to display it. The less a hacker can see, the fewer opportunities to exploit. Although this does not increase the
application’s attack surface, it has the same impact since it limits the attacker’s ability to find accessible options.
The second is a decrease in network visibility. Verizon’s networks will only grow and become more useable by mobile users
and gadgets when 5G rolls out. As a result, there will be a significant increase in network traffic to cope with. Furthermore, without a
complete Wide Area Network (WAN) security solution in place, such as Secure Access Service Edge (SASE), enterprises may not be
able to see network traffic to notice attacks or anomalies.
More IoT (Internet of Things) devices mean more issues. While IoT has already found use in many business sectors, providing
information, digitization, and other services that would not have been possible before, many organizations overlook the challenges IoT
devices pose to 5G networks when securing network architecture (Gandotra & Jha, 2017). Inherently, IoT devices are unsafe. Each
unsecured IoT device on a company’s network, such as Verizon’s, provides another possible attack vector. In addition, because of the
transformative nature and far-reaching of IoT-based initiatives and their inherent complexity, poorly designed industrial IoT solutions
may provide infrastructure hazards to network service providers.
Finally, growing supply chain and software vulnerabilities are a concern. 5G supply chains are currently and in the foreseeable
future constrained. Vulnerabilities abound, incredibly as products are hurried to market, resulting in the possibility of defective and
insecure components. 5G is considerably more software-dependent than existing mobile networks, increasing the danger of network
infrastructure exploitation.
20
The NIST (National Institute of Standards and Technology) paper “Risk Management Guide for Information Technology
Systems” gives a guide for risk appraisal, assessment, and mitigation more particularly connected to information systems
(Cherdantseva et al., 2016). The table below represents the various steps.
21
Step 1: Prepare for an Assessment
Adapted from the risk framework of the
company
Step 2: Conduct Assessment
Task viewing in its entirety
Identify Sources Of Threat And
Events
Determine Predisposing
Conditions And Vulnerabilities
Determine Occurrence
Likelihood
22
Determine Impact Size
Determine Risks
Step 3: Communicate
Results
Step 4: Assessment
Maintenance
Table 1: Risk Management Guide for Information Technology Systems (i.e., Verizon’s 5G technology)
23
3.2 Risk Probability
When there are several alternative outcomes to a choice, risk refers to the circumstance where the likelihood of each
result is either known or may be predicted. In order to avoid the common problem of evaluating likelihood and effect to the
‘middle’ value, an even number of ranges of values is advised, e.g., low, medium, high, extreme/critical. The frequency of
probable risk occurrence might be used to create a probability range of values.
Figure 1: Risk Evaluation Procedure
Because the technology is not yet operational and used, calculating risk likelihood and effect for 5G assets is somewhat
tricky. The potential attack value, which is derived using the factors of competence, time, opportunity, knowledge, and
equipment, is used to determine the likelihood (Chochliouros et al., 2021). The attack intensity and asset impact values are
used to compute the impact. The Threat, Vulnerability, and Risk Assessment (TVRA) technique typically assign three or four
24
risk levels: low, medium, high, and critical, based on a qualitative evaluation of likelihood and effect. The Low-risk level is
the only one considered to be acceptable and, therefore, countermeasures should be introduced to reduce all Medium/High or
Critical risks to Minor.
3.3 Risk Matrix Template
Risk matrices can help determine the priority of risks. Once the severity and likelihood of risks are determined, the risks are
then listed to be addressed.
Risk
Risk
Probability
Impact
Response to Risk
Action Plan
#
1.
Person
Status
Responsible
quality
Very high
catastrophic Perform regular
The project
performance testing.
manager will
Reserve time for
reserve about
performance
two weeks for
optimization.
performance
Project manager
ongoing
ongoing
optimization
2.
Human
resource
high
critical
Secure required
Resources for
Business
resources
mobile
manager
development
25
Risk
Risk
Probability
Impact
Response to Risk
Action Plan
#
Person
Status
Responsible
Develop a cross-
are in high
project human
demand and are
resource plan
limited.
Therefore, the
business
manager should
ensure the
availability of
required
resource
Table 2. Risk Matrix Template for Verizon Company.
26
3.4 Risk Data Quality Strategy
A project management technique for identifying the degree to which risk data is necessary is risk data quality evaluation. The
information used in risk assessments is unbiased and reliable, thanks to this project management tool. Notably, the project manager
must assess the amount of risk understanding, acquire available data, and analyze the data’s reliability, integrity, and quality as part of
the risk data quality review. Only by considering these risk characteristics can an appropriate evaluation be made and reliability
established. It is simple to make a mistake in analysis when data reliability is not checked, leaving project operations open to hazards.
3.5 Risk Reviews
A discussion to assess and document the efficacy of risk responses in dealing with specific project hazards and overall project
risks. The risk lifecycle highlights the importance of project managers identifying, analyzing, preventing, and controlling the risks that
the project faces throughout its development. This business process should occur throughout the project, assessing risks regularly to
ensure that mitigation methods are constantly current (Radu & Amon, 2021). Events that may impact the project, and steps the team
may take to mitigate risk, should be regularly monitored. Verizon invests heavily in protecting its 5G network against unknown and
known risks. This wireless network operator keeps a close eye on networks to spot threats and respond appropriately. Moreover,
Security Operations Center monitors the networks to detect any hostile activity.
27
Risk Monitoring and Control Template example
Continuation of Review and
Owner
Time Estimate
employer
Regularly, i.e., in a span of two to
Action Plan
Identification, analysis, and
evaluation of risks
three weeks.
(Technology risk, i.e., selected
components may fail to work correctly or
the customer infrastructure might change
requiring updates)
Risks are regularly reviewed to
Project manager
After every two weeks
Project manager
Regularly whenever there is a
ensure that mitigation methods are
current.
Issuing reporting through the
company’s communication channels.
need.
These may include social media, face-toface meetings, project websites, and
online media.
Table 3: Risk Monitoring and Control Template
28
In a nutshell, 5G networks will have complex security needs at multiple system tiers. Furthermore, with early standardization, novel
security solutions commensurate to the dangers must be included in the network from the beginning. Investing in 5G security today is
also an intelligent insurance policy to avoid future expenses associated with defending against attacks or dealing with the implications
of inadequately secure high-value data and operations. Today’s security decision will prove to be a false economy in the future.
29
Section 4 – Corrective Action and Monitoring
4.1 Risk Tolerance
Evaluate the organizational and departmental tolerance for risk.
•
Discuss the different risk tolerances within the organization.
4.2 Risk Mitigation
Identify risk mitigation approaches in support of the project.
•
How will you implement the mitigation approaches?
•
Have you identified specific triggers to initiate mitigation?
4.3 Corrective Risk Management Strategy
Describe your strategy for corrective risk management.
•
Explain whether you will use auditing, strategic planning, or another type.
•
Describe the corrective action process and responsibilities.
•
Will you be performing a risk postmortem? If not, why not?)
4.4 Corrective Action Plan
Assess corrective plan procedures in support of the project.
•
Is your documentation available to others?
30
•
Is it reviewed by the team or others?
Section 5 – Postmortem Plan
5.1 Results
Identify and describe how results data will be collected and reviewed to determine corrective actions.
•
Did your postmortem results lead to any concrete changes? Explain.
5.2 Follow Up
Evaluate the organization’s view of risk management and approach, resulting from project outcomes.
•
Did this project change the organization’s approach and management of risk?
Describe the impact of postmortem results on the organization.
Recommend corrective plan procedures to effectively manage risk.
•
What recommendations would you make for future risk management projects?
•
What resources did you use to support your assertions?
6 – References
Alkinani, H. H., Al-Hameedi, A. T. T., & Dunn-Norman, S. (2021, April). Minimizing Lost Circulation Non-Productive Time Using
Expected Monetary Value and Decision Tree Analysis. In SPE Western Regional Meeting. OnePetro.
Kabanda, G. (2021). Cybersecurity risk management plan for a blockchain application model. Trans Eng Comput Sci, 2(1), 221.
31
Qazi, A., Dickson, A., Quigley, J., & Gaudenzi, B. (2018). Supply chain risk network management: A Bayesian belief network and
expected utility based approach for managing supply chain risks. International Journal of Production Economics, 196, 24-42.
Smog. (2020). Understanding risk management. Retrieved from https://www.smfg.co.jp/english/aboutus/pdf/risk.pdf
Extension rime. (2020). Introduction to Risk Management. Retrieved from,
http://extensionrme.org/pubs/introductiontoriskmanagement.pdf
Srivastava, M., & Rogers, H. (2021). Managing global supply chain risks: effects of the industry sector. International Journal of
Logistics Research and Applications, 1-24.
Vijayan, V. K., & Sharma, D. (2020). Relationship Between Organizational Cultural Drivers and Risk Management Plan From
Enterprise Risk Management (Erm) Perspective–(a Study With Reference to the Projects Handled by It Companies in the
UAE). International Journal of Management, 11(5).
32
Extension rime. (2020). Introduction to Risk Management. Retrieved from,
http://extensionrme.org/pubs/introductiontoriskmanagement.pdf
Bushberg, J. T., Chou, C. K., Foster, K. R., Kavet, R., Maxson, D. P., Tell, R. A., & Ziskin, M. C. (2020). IEEE Committee on Man and
Radiation—COMAR Technical Information Statement: Health and Safety Issues Concerning Exposure of the General Public to Electromagnetic
Energy from 5G Wireless Communications Networks. Health Physics, 119(2), 236.
Carlton, M., Levy, Y., & Ramim, M. (2019). Mitigating Cyber-Attacks through the Measurement of Non-IT Professionals’ Cybersecurity
Skills. Information & Computer Security.
Cerdeira, D., Santos, N., Fonseca, P., & Pinto, S. (2020, May). Sok: Understanding the Prevailing Security Vulnerabilities in Trust Zone-Assisted
Tee Systems. In 2020 IEEE Symposium on Security and Privacy (SP) (Pp. 1416-1432). IEEE.
Dasgupta, K., Gibson, T., & Williams, M. (2021). Technological and Geographic Heterogeneity in Broadband Markets: The Challenge for
Regulation. Telecommunications Policy, 45(1), 102042.
Foster, K. R., Chou, C. K., & Petersen, R. C. (2018). Radiofrequency Exposure Standards. In Bioengineering and Biophysical Aspects of
Electromagnetic Fields (Pp. 463-511). CRC Press.
33
Javaid, N., Sher, A., Nasir, H., & Guizani, N. (2018). Intelligence in IoT-Based 5G Networks: Opportunities and Challenges. IEEE
Communications Magazine, 56(10), 94-100.
Obaidat, M. A., Obeidat, S., Holst, J., Al Hayajneh, A., & Brown, J. (2020). A Comprehensive and Systematic Survey on the Internet of Things:
Security and Privacy Challenges, Security Frameworks, Enabling Technologies, Threats, Vulnerabilities, and Countermeasures. Computers, 9(2),
44.
Shoebridge, M. (2018). Chinese Cyber Espionage and the National Security Risks Huawei Poses To 5G Networks. Macdonald-Laurier Institute
for Public Policy.
Varatharajan, R., Manogaran, G., Priyan, M. K., Balaş, V. E., & Barna, C. (2018). Visual Analysis of Geospatial Habitat Suitability Model Based
on Inverse Distance Weighting with Paired Comparison Analysis. Multimedia Tools and Applications, 77(14), 17573-17593.
Yan, F., Zhang, Q., Ye, S., & Ren, B. (2019). A Novel Hybrid Approach for Landslide Susceptibility Mapping Integrating Analytical Hierarchy
Process and Normalized Frequency Ratio Methods with the Cloud Model. Geomorphology, 327, 170-187.
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016). A Review of Cyber Security Risk
Assessment Methods for SCADA Systems. Computers & Security, 56, 1–27. https://doi.org/10.1016/j.cose.2015.09.009
Chochliouros, I. P., Spiliopoulou, A. S., Kostopoulos, A., Kourtis, M.-A., Lazaridis, P. I., Zaharis, Z. D., & Prasad, N. R. (2021).
Security Threat Analysis of the 5G Essence Platform. Wireless Personal Communications, 120(3), 2409–2426.
https://Doi.Org/10.1007/S11277-021-08554-5
34
Gandotra, P., & Jha, R. K. (2017). A Survey on Green Communication and Security Challenges in 5G Wireless Communication
Networks. Journal Of Network and Computer Applications, 96, 39–61. https://Doi.Org/10.1016/J.Jnca.2017.07.002
Radu, R., & Amon, C. (2021). The Governance Of 5G Infrastructure: Between Path Dependency and Risk-Based Approaches. Journal
Of Cybersecurity, 7(1), Tyab017.
Van Western, C. J. (2017). 5.5 Methods for Risk Assessment. CHARIM. http://Charim.Net/Methodology/55
35
36
Risk Management Plan
Project Name: Installation of 5G home band and wireless devices
Learner Name: Supratim Dutta
Course Name: PM5334 Project Risk Assess & Control
Date: 01/25/2022
Table of Contents
Risk Management Plan
Section 1 – Introduction to the Plan
1
4
1.1 Benefits of Risk Management
4
1.2 Project Goals and Objectives
5
1.3 Company Background
5
1.4 Risk Identification
6
Risk identification would definitely play a very important role while the risk management has to be taken into consideration. The
different types of risk that visit talking about right now has been mentioned below,
6
1
1.
There are multiple dependencies that have been associated especially with the involvement of external vendors in the market.
2.
All the requirements that would include a lot of scope volatility has been dependent upon the parent program team with the
6
product management would be completely taken the responsibility in order to integrate the Sub products based on the business
requirements.
3.
6
There is a product management team that has been predominantly associated with the waterfall model, the different types of
upstream as well as the downstream systems especially in the other countries would be focusing on the Agile release Management
process which is predominantly making the delivery a bit tough because of the collaboration of two different models.
6
Section 2 – Risk Scope, Components, and Value
6
2.1 Scope of the Risk Management Plan
7
2.2 Risk Management Plan Components
7
2.3 Expected Monetary Value
8
2.4 Determine the Risks
10
2.5 Evaluate and Assess the Risks
11
2.6 Qualitative and Quantitative Processes
12
Section 3 – Risk Analysis and Assessment
19
3.1 Major and Minor Risks
19
3.2 Risk Probability
19
3.3 Risk Matrix Template
24
3.4 Risk Data Quality Strategy
27
2
3.5 Risk Reviews
Section 4 – Corrective Action and Monitoring
27
27
4.1 Risk Tolerance
30
4.2 Risk Mitigation
30
4.3 Corrective Risk Management Strategy
30
4.4 Corrective Action Plan
30
Section 5 – Postmortem Plan
30
5.1 Results
31
5.2 Follow Up
31
6 – References
31
3
Section 1 – Introduction to the Plan
1.1 Benefits of Risk Management
It is really a known fact that the risk management would be playing a very important role in the organization as it will help us to bring
a proper assessment of the respect to risk factors that would be both external as well as internal.
Benefits and risk management
●
Risk management will be generally useful in order to manage the cultural aspect of the business organization where the
focus would be associated in every proactive way in order to have an understanding of the analysis of the risk factors.
●
It will also help in managing the Castro with events where managers would be trying to have a look at all the aspects with
the day-to-day business organization and management.
●
the process will help in enabling the necessary growth where there would be connotations of the respective assumption.
●
having the proper management of risk management in the organization will help him stay competitive.
4
1.2 Project Goals and Objectives
The current project we are talking about right now would be associated with the installation of 5G home band and wireless devices
especially in the markets of the United States of America. The focus has been highly associated with the predominant aspect of
predominantly integrating the organization with respect to elders who would be focusing on the installation process. The installation
process would also be differentiated based on the scope as well as the size of the product.
The objective of the project is to have an installation of 5000 installations especially at the end of the current financial year. The
organization has also been focusing on integrating itself with three different vendors apart from the internal installations of the
organization. This would help to bring in proper revenue especially with the involvement of multiple Saab markets that would include
the customer trial from the commercial as well as the other business Ventures.
1.3 Company Background
Verizon is one of the largest multinational organizations across the globe. It would be focusing on internal as well as external projects
that would be predominantly focusing on telecommunications. We would be talking about an Agile release train right that has its
initial focus on the network Asia as a Project where there would be multiple aspects especially related to the emergency management
as well as 5G fixed wireless customer support which would be focusing on multiple markets in the United States of America.
5
1.4 Risk Identification
Risk identification would definitely play a very important role while the risk management has to be taken into consideration. The
different types of risk that visit talking about right now has been mentioned below,
1. There are multiple dependencies that have been associated especially with the involvement of external vendors in the
market.
2. All the requirements that would include a lot of scope volatility has been dependent upon the parent program team with the
product management would be completely taken the responsibility in order to integrate the Sub products based on the business
requirements.
3. There is a product management team that has been predominantly associated with the waterfall model, the different types
of upstream as well as the downstream systems especially in the other countries would be focusing on the Agile release
Management process which is predominantly making the delivery a bit tough because of the collaboration of two different
models.
Section 2 – Risk Scope, Components, and Value
6
2.1 Scope of the Risk Management Plan
Scope of the risk management plan
The transmission and implementation of 5G can be affected by various risk factors. The scope of this risk management plan
will work to cover the risks defined in this plan along with the appropriate action to take.
The risk management plan will cover supply chain risks associated with the supply and installation of 5G devices. Supply
chain risks are defined as the efforts done by threat actors to exploit information and telecommunication devices for criminal activity,
sabotage, or espionage (Qazi et al., 2018). The desire and popularity that 5G is gaining expose it to supply chain risks such as
counterfeit components, poor maintenance procedures, defects in the manufacturing processes, and malicious software and hardware.
Counterfeit components covered in the risk management plan will include counterfeit components and infrastructure.
The risk management plan will cover subsystem threat vectors. It will ensure that the risks of software configuration
vulnerabilities are addressed. Verizon will constantly monitor network connections to ensure that 5G network connections are secured
properly to avoid destruction or manipulation of critical data.
Some of the best practices that will be implemented include; vetting all vendors and manufacturers to ensure that they are
credible, security systems will constantly be used in monitoring network actions, the standard of supplied devices and infrastructures
cross-checked for authenticity (Srivastava & Rogers, 2021). These best practices will ensure that Verizon saves time by getting
7
reliable devices. It will be able to secure network communication hence improving its reputation, and It will enable the organization to
comply with the government laws and policies.
2.2 Risk Management Plan Components
Components of risk management
●
Identification of the emergency management risk sector
Verizon will need to perform a SWOT analysis to identify internal and external risks effectively. Verizon bears the responsibility
of identifying all risks, including those likely to arise from natural calamities (Kabanda, 2021). The best practice would be to
ensure that places prone to natural calamities like floods are avoided as much as possible during commercial 5G equipment
installation.
● Resources and other things which have been associated to analyze it
After registering the risks in the register, an analysis is done by classifying the impacts of the risk based on its likelihood, impact,
and how vulnerable the organization can get. Verizon is responsible for using a risk matrix to have a reliable visualization of the
risk assessment (Vijayan & Sharma, 2020). A best practice would be for Verizon to check its risk tolerance level and willingness
to accept risks.
8
● Involvement of the necessary stakeholders including the internal as well as the external.
Monitoring of the risks during the project implementation can be done quarterly. The -project manager at Verizon will ensure
that the program cycle reviews are done during the review meetings.
● Involvement of project coordinator along with other risk aspects.
Involvement with the project coordinator will include reporting processes covering directions, effectiveness, accountability,
and supervision in the organization.
Processes Involved in The Risk Management Plan
The first process involved identifying risks through SWOT analysis and brainstorming. The second process is the evaluation
and assessment of potential risks. Communication and collaboration can handle risk assessment and management (Vijayan & Sharma,
2020). The third process is to create responses to the identified risks. Verizon will create a risk response in this phase and decide
whether to accept the risk, mitigate, or transfer. Finally, through the project manager and other risk management team members,
Verizon will continuously monitor risks.
9
2.3 Expected Monetary Value
The identification of the emergency management sector in the involvement of file implementation in the United States of America
can be estimated with 1.5 million dollars of monetary effort because there would be involvement of sectors that have been associated
with different states. The expected monetary cost that has to be afforded for the involvement of other risk factors would be around 2.7
billion dollars. Delay in the project cost due to the involvement of dependency teams from other organizations could cost them 1
billion dollars
The communication process would also be managed by the project management team itself where overall this should be
segregated into high level and low level and medium level. The high-level rest must be immediately prioritized and brought up with a
proper plan as they were the things which would be employed in the team delivery at multiple levels. Medium level and low level this
can be going to the second priority because it would not require immediate importance.
The expected monetary value of the project without risk management will greatly be affected by the probability of the risks and
their impacts. In this case, the project value with an adequate risk management plan is $1.5 Million, while the cost without the risk
management plan is 2.7 billion. Some of the tangible costs arising from the risks include; damage to equipment, buildings,
investments, and infrastructures. Verizon’s intangible costs likely to encounter from the risks include account receivables, service
provision, expenses, and the local communities’ goodwill (Alkinani, et al., 2021).
10
2.4 Determine the Risks
In recent decades, wireless technology has advanced significantly. The 5th Generation of Mobile and Wireless Communications,
often known as 5G, marks a total transformation in mobile networks, allowing users, and apps to meet ever-increasing demands. With
download speeds up to one gigabyte and average rates of 300 Mbps, Verizon 5G Home Internet provides subscribers with ultra-fast
wireless home internet (Dasgupta, Gibson, & Williams, 2021). These blistering home internet rates are achievable because 5G Home
is powered by Verizon 5G Ultra-Wideband (Dasgupta, Gibson, & Williams, 2021). It can deliver reduced latency, more capacity, and
faster speeds than 4G LTE networks. The advantages of a 5G connection are expected to boost business productivity and give
consumers more rapid access to information than ever before. While the benefits of 5G technology are undeniable, its implementation
is fraught with difficulties and threats. Thus, the purpose of this paper is to determine the numerous risks associated with the
installation of 5G home bands and wireless devices and to evaluate and analyze the risks.
5G technology raises several public health concerns. Numerous studies on the health effects of Radiofrequency (RF) radiation
have been undertaken, with mixed results (Bushberg, Chou, Foster, Kavet, Maxson, Tell, & Ziskin, 2020). However, there is little
study on the impact of 5G technology on humans exposed to a higher concentration of RF radiation due to the increasing number of
antennas used. In Canada, RF energy is regulated and governed efficiently. Additionally, Health Canada has established
recommendations for this sort of energy exposure.
For quite some time, Huawei, a well-known Chinese manufacturer of 5G-compatible equipment, has been the target of security
concerns over implementing this technology. Several reports have detected several security holes in Huawei’s firmware and software
11
(Cerdeira, Santos, Fonseca, & Pinto, 2020). Furthermore, Huawei’s Cyber Security Evaluation Centre (CSEC) in the United
Kingdom’s Oversight Board concludes that Huawei’s effort to fix these issues is insufficient (Shoebridge, 2018). Furthermore,
Chinese legislation mandates that businesses work with national intelligence agencies, increasing worries about possible Chinese
government eavesdropping via Huawei’s equipment. As a result, several nations have barred Huawei from their networks, including
Australia, Japan, and the United States. In contrast, the United Kingdom has decided to grant them partial access even though the
national government has not announced its intentions regarding Huawei’s engagement in the construction of Canada’s 5G
infrastructure. The Chinese company’s role in creating 5G equipment poses security concerns in Canada.
2.5 Evaluate and Assess the Risks
Verizon’s 5G network opens the potential for risk management and assessments solutions with more visibility and more specific information into
the network than prior generations. These advanced virtualization capabilities will boost the efficiency of Verizon’s cutting-edge and
comprehensive security risk management practices, which have been used in previous generations and will be enhanced even further with 5G
capabilities. The 5G capabilities include hardware and software vulnerability management processes, security monitoring and response
capabilities, and corporate policies and governance.
Security Operations
Verizon invests heavily in protecting its 5G network against unknown and known risks. This wireless network operator keeps a close eye on
networks to spot threats and respond appropriately. A Security Operations Center monitors the networks to detect any hostile activity. All relevant
12
connections are encrypted to prevent snooping and properly fragmented to prevent an “infection” linked to one piece of equipment from spreading
to the rest of the network. This includes connections between clients and 5G antennae and between various 5G network components.
Verizon uses other preventative measures and methods in addition to technological controls. The concept of least privilege is the first. This is the
practice of granting a user the bare minimum of permissions to conduct activities required for the job function. Secondly is the dual control
technique that entails two or more independent organizations working together to secure critical information or procedures. As a result, no one can
access or utilize the materials. Segregation of duties is another technique. This entails delegating phases to several people to prevent anyone from
tampering with the whole process. Finally, a multiparty authentication approach is used, requiring two or more authentication processes for remote
access.
Verizon uses detective methods such as network Data Loss Prevention and intrusion detection to examine network traffic for unlawful information
transmissions and malware to find issues not addressed by existing measures. Artificial Intelligent (AI) will provide a more efficient approach to
security in the future, allowing for continuous threat monitoring. By incorporating AI into the network’s software-based design, the 5G network
opens up possibilities for its utilization (Javaid, Sher, Nasir, & Guizani, 2018). Through AI skills combined with security automation, large
volumes of data might be swiftly processed for threat detection and mitigation. Verizon’s 5G network will provide more and faster insight into
network activity and the ability to differentiate threats and anomalous network activity, all of which will aid security monitoring and response.
Hardware and Software Vulnerability Management
Vulnerabilities must be addressed as part of 5G security risk management. Verizon has created a sophisticated vulnerability control approach and
acquired hardware and software from trustworthy vendors. Verizon monitors a variety of sources daily to spot patterns that might indicate new
13
vulnerabilities. Vulnerabilities tracking is one indicator of Verizon’s security evaluation, assessment, and resolution performance. According to its
corporate policy, patches and service packs must be administered to Verizon Information Resources in a standardized and prioritized way to
maintain its safety. Since software updates and fixes are more effectively distributed at scale in a software-oriented system than in a predominantly
hardware-based system, software vulnerability assessment shall become more effective as Verizon goes through the Stand Alone 5G transition.
Corporate Governance and Policy
Across Verizon’s network footprint, risk management activities are continuous, including client services and products that may include sensitive
data, internal systems, and networks. Verizon’s Enterprise Information Security Group offers a set of security policies and practices that adhere to
the NIST (National Institute of Standards and Technology) Cybersecurity Framework (Carlton, Levy & Ramim, 2019). Each of the Framework’s
five Core Functions – Define, Protect, Detect, React, and Recover – is represented by an internal, formal corporate-wide policy that establishes the
business processes and personal choices required for security and the standards for Verizon’s infrastructure and supporting applications and
systems. Verizon also maintains several extensive Corporate Information Security Standards, which define the core security controls that must be
in place to support each security instruction.
Verizon reviews and updates these rules and standards on an annual and as-needed basis, considering changing technological capabilities,
regulatory compliance demands, good practices, implementation, and practical experiences. Individual contributor ideas, internal audit results, and
14
organizational units’ audits are all sources of compliance proposals for the Enterprise Information Security Group. Updates are integrated into the
policy after a comprehensive review and approval procedure and delivered to internal stakeholders via Security Management Briefs every month.
Routine inspection, security testing, and uniform installation of the components that make up the corporation’s network are steps in establishing a
safe network foundation. To establish a secure 5G network, a secure setup of network equipment and devices is a fundamental need. As a result,
Verizon’s technical security specialists conduct a pre-launch security risk assessment for both externally and internally branded devices and
applications, putting key 5G features to the test to identify any security problems. The network security team also employs a specialized
professional security testing specialist to analyze essential programs once installed. Outside experts also help the team test 5G user products like
MiFi pucks, 5G home routers, and phones.
First, Verizon evaluates particular possible hazards associated with deploying the application or device using a technique known as threat
modeling. This wireless network operator conducts third-party and internal security checks on-device application layers based on specific threats
to detect attacks that could be utilized on two fronts: the “external threat” from an outside hacker and the “insider threat” from a nefarious insider
(Obaidat, Obeidat, Holst, Al Hayajneh, & Brown, 2020). The conclusions of this security risk assessment will determine whether or not Verizon
has to make any changes before moving forward with the service or product in question. Verizon then collaborates with the system or product
15
provider to verify that any security concerns have been addressed before launch and that the equipment and devices in question have been securely
and properly set up.
Besides industry standards, Verizon develops and publishes specific technical requirements that client equipment manufacturers must follow to
maintain security. These requirements provide smooth connectivity of user equipment and 5G network operations and handle topics not covered
by industry standards, such as securing boot and update utilizing trust and certificate management roots.
2.6 Qualitative and Quantitative Processes
Risk assessment may be required for network security, and one deliverable may be utilized to deal with threats, facilitating the development of a
security plan. In the process of risk assessment, the analytical hierarchy approach is frequently employed as a quantitative and qualitative analysis
tool (Yan, Zhang, Ye & Ren, 2019). The first step in evaluating a system utilizing the analytical hierarchy technique is to create a hierarchical
model. Then, using a hierarchical model, certain unquantifiable and qualitative aspects are quantified, and some quantitative data is generated
through processing and analysis to aid decision-makers.
The traditional Analytical Hierarchy Process (AHP) technique may be broken into four parts for information security risk assessment. The first is
the system’s hierarchical structure model. The goal of this stage is to examine the system’s relevant components. The system is then stratified
according to a set of criteria. The criteria, goal, and scheme layers are generally the three layers that make up the system. A structural judgment
16
matrix is the second phase. The weight of the criterion is calculated using a judgment matrix. Nine-point scales have been proposed to make
comparisons more efficient, as illustrated in the table below.
17
Table 1. The Numerical Scale in AHP Employed in the Paired Comparison (Varatharajan, Manogaran, Priyan, Balaş, & Barna, 2018)
Significance
Description
1
There are two equally vital factors
3
One factor is less essential than the other
5
One factor is more essential than another
7
One factor is strongly essential than another
9
One factor is more essential than another
4, 2, 6, 8
These are choice values that are in the middle
Calculating the weighted value of the single layer is the third stage in this security risk evaluation. It involves calculating the judgment matrix’s
characteristic vector and then normalizing it to obtain the single layer’s weight. The final step is to calculate each layer element’s final
combination weight.
18
In a nutshell, Verizon’s deployment of wireless devices and 5G technology is fraught with dangers and risks. However, the present installation
provides better visibility and precise insights into the network than earlier generations, allowing for risk assessments and management measures.
As a result, the advanced capabilities will improve the efficacy of the network and device’s state-of-the-art and comprehensive risk management
techniques. 5G technology will revolutionize commerce and personal life by bringing a slew of new perks and possibilities.
Section 3 – Risk Analysis and Assessment
Risk assessment may be required for network security, and one deliverable may be utilized to deal with threats, facilitating the development of a
security plan. It is the process of identifying risks that may negatively influence a firm’s capacity to do business. While the benefits of 5G
technology are undeniable, its development and implementation are fraught with several risks. Thus, this paper seeks to determine major and
minor risks associated with installing 5G home bands and wireless devices, determine the probability of the risks, check the risk data quality
strategies and review these risks.
3.1 Major and Minor Risks
Installation of the 5G technology at Verizon company comes with numerous major and minor risks. Quantitative risk
identification and assessment approaches are preferred here because they analyze multiple risk-reduction options through a
comparison of risk before and after adoption, as well as cost-benefit analysis (Van-Western, 2017). The first risk is a larger attack
surface. With millions, if not billions, more devices linked, 5G allows for more significant and hazardous attacks. With 5G, the
19
potential of more advanced privacy breaches, botnets, and speedier data extraction might increase. Notably, if a parameter is not being
used, it is best not to display it. The less a hacker can see, the fewer opportunities to exploit. Although this does not increase the
application’s attack surface, it has the same impact since it limits the attacker’s ability to find accessible options.
The second is a decrease in network visibility. Verizon’s networks will only grow and become more useable by mobile users
and gadgets when 5G rolls out. As a result, there will be a significant increase in network traffic to cope with. Furthermore, without a
complete Wide Area Network (WAN) security solution in place, such as Secure Access Service Edge (SASE), enterprises may not be
able to see network traffic to notice attacks or anomalies.
More IoT (Internet of Things) devices mean more issues. While IoT has already found use in many business sectors, providing
information, digitization, and other services that would not have been possible before, many organizations overlook the challenges IoT
devices pose to 5G networks when securing network architecture (Gandotra & Jha, 2017). Inherently, IoT devices are unsafe. Each
unsecured IoT device on a company’s network, such as Verizon’s, provides another possible attack vector. In addition, because of the
transformative nature and far-reaching of IoT-based initiatives and their inherent complexity, poorly designed industrial IoT solutions
may provide infrastructure hazards to network service providers.
Finally, growing supply chain and software vulnerabilities are a concern. 5G supply chains are currently and in the foreseeable
future constrained. Vulnerabilities abound, incredibly as products are hurried to market, resulting in the possibility of defective and
insecure components. 5G is considerably more software-dependent than existing mobile networks, increasing the danger of network
infrastructure exploitation.
20
The NIST (National Institute of Standards and Technology) paper “Risk Management Guide for Information Technology
Systems” gives a guide for risk appraisal, assessment, and mitigation more particularly connected to information systems
(Cherdantseva et al., 2016). The table below represents the various steps.
21
Step 1: Prepare for an Assessment
Adapted from the risk framework of the
company
Step 2: Conduct Assessment
Task viewing in its entirety
Identify Sources Of Threat And
Events
Determine Predisposing
Conditions And Vulnerabilities
Determine Occurrence
Likelihood
22
Determine Impact Size
Determine Risks
Step 3: Communicate
Results
Step 4: Assessment
Maintenance
Table 1: Risk Management Guide for Information Technology Systems (i.e., Verizon’s 5G technology)
23
3.2 Risk Probability
When there are several alternative outcomes to a choice, risk refers to the circumstance where the likelihood of each
result is either known or may be predicted. In order to avoid the common problem of evaluating likelihood and effect to the
‘middle’ value, an even number of ranges of values is advised, e.g., low, medium, high, extreme/critical. The frequency of
probable risk occurrence might be used to create a probability range of values.
Figure 1: Risk Evaluation Procedure
Because the technology is not yet operational and used, calculating risk likelihood and effect for 5G assets is somewhat
tricky. The potential attack value, which is derived using the factors of competence, time, opportunity, knowledge, and
equipment, is used to determine the likelihood (Chochliouros et al., 2021). The attack intensity and asset impact values are
used to compute the impact. The Threat, Vulnerability, and Risk Assessment (TVRA) technique typically assign three or four
24
risk levels: low, medium, high, and critical, based on a qualitative evaluation of likelihood and effect. The Low-risk level is
the only one considered to be acceptable and, therefore, countermeasures should be introduced to reduce all Medium/High or
Critical risks to Minor.
3.3 Risk Matrix Template
Risk matrices can help determine the priority of risks. Once the severity and likelihood of risks are determined, the risks are
then listed to be addressed.
Risk
Risk
Probability
Impact
Response to Risk
Action Plan
#
1.
Person
Status
Responsible
quality
Very high
catastrophic Perform regular
The project
performance testing.
manager will
Reserve time for
reserve about
performance
two weeks for
optimization.
performance
Project manager
ongoing
ongoing
optimization
2.
Human
resource
high
critical
Secure required
Resources for
Business
resources
mobile
manager
development
25
Risk
Risk
Probability
Impact
Response to Risk
Action Plan
#
Person
Status
Responsible
Develop a cross-
are in high
project human
demand and are
resource plan
limited.
Therefore, the
business
manager should
ensure the
availability of
required
resource
Table 2. Risk Matrix Template for Verizon Company.
26
3.4 Risk Data Quality Strategy
A project management technique for identifying the degree to which risk data is necessary is risk data quality evaluation. The
information used in risk assessments is unbiased and reliable, thanks to this project management tool. Notably, the project manager
must assess the amount of risk understanding, acquire available data, and analyze the data’s reliability, integrity, and quality as part of
the risk data quality review. Only by considering these risk characteristics can an appropriate evaluation be made and reliability
established. It is simple to make a mistake in analysis when data reliability is not checked, leaving project operations open to hazards.
3.5 Risk Reviews
A discussion to assess and document the efficacy of risk responses in dealing with specific project hazards and overall project
risks. The risk lifecycle highlights the importance of project managers identifying, analyzing, preventing, and controlling the risks that
the project faces throughout its development. This business process should occur throughout the project, assessing risks regularly to
ensure that mitigation methods are constantly current (Radu & Amon, 2021). Events that may impact the project, and steps the team
may take to mitigate risk, should be regularly monitored. Verizon invests heavily in protecting its 5G network against unknown and
known risks. This wireless network operator keeps a close eye on networks to spot threats and respond appropriately. Moreover,
Security Operations Center monitors the networks to detect any hostile activity.
27
Risk Monitoring and Control Template example
Continuation of Review and
Owner
Time Estimate
employer
Regularly, i.e., in a span of two to
Action Plan
Identification, analysis, and
evaluation of risks
three weeks.
(Technology risk, i.e., selected
components may fail to work correctly or
the customer infrastructure might change
requiring updates)
Risks are regularly reviewed to
Project manager
After every two weeks
Project manager
Regularly whenever there is a
ensure that mitigation methods are
current.
Issuing reporting through the
company’s communication channels.
need.
These may include social media, face-toface meetings, project websites, and
online media.
Table 3: Risk Monitoring and Control Template
28
In a nutshell, 5G networks will have complex security needs at multiple system tiers. Furthermore, with early standardization, novel
security solutions commensurate to the dangers must be included in the network from the beginning. Investing in 5G security today is
also an intelligent insurance policy to avoid future expenses associated with defending against attacks or dealing with the implications
of inadequately secure high-value data and operations. Today’s security decision will prove to be a false economy in the future.
29
Section 4 – Corrective Action and Monitoring
4.1 Risk Tolerance
Evaluate the organizational and departmental tolerance for risk.
•
Discuss the different risk tolerances within the organization.
4.2 Risk Mitigation
Identify risk mitigation approaches in support of the project.
•
How will you implement the mitigation approaches?
•
Have you identified specific triggers to initiate mitigation?
4.3 Corrective Risk Management Strategy
Describe your strategy for corrective risk management.
•
Explain whether you will use auditing, strategic planning, or another type.
•
Describe the corrective action process and responsibilities.
•
Will you be performing a risk postmortem? If not, why not?)
4.4 Corrective Action Plan
Assess corrective plan procedures in support of the project.
•
Is your documentation available to others?
30
•
Is it reviewed by the team or others?
Section 5 – Postmortem Plan
5.1 Results
Identify and describe how results data will be collected and reviewed to determine corrective actions.
•
Did your postmortem results lead to any concrete changes? Explain.
5.2 Follow Up
Evaluate the organization’s view of risk management and approach, resulting from project outcomes.
•
Did this project change the organization’s approach and management of risk?
Describe the impact of postmortem results on the organization.
Recommend corrective plan procedures to effectively manage risk.
•
What recommendations would you make for future risk management projects?
•
What resources did you use to support your assertions?
6 – References
Alkinani, H. H., Al-Hameedi, A. T. T., & Dunn-Norman, S. (2021, April). Minimizing Lost Circulation Non-Productive Time Using
Expected Monetary Value and Decision Tree Analysis. In SPE Western Regional Meeting. OnePetro.
Kabanda, G. (2021). Cybersecurity risk management plan for a blockchain application model. Trans Eng Comput Sci, 2(1), 221.
31
Qazi, A., Dickson, A., Quigley, J., & Gaudenzi, B. (2018). Supply chain risk network management: A Bayesian belief network and
expected utility based approach for managing supply chain risks. International Journal of Production Economics, 196, 24-42.
Smog. (2020). Understanding risk management. Retrieved from https://www.smfg.co.jp/english/aboutus/pdf/risk.pdf
Extension rime. (2020). Introduction to Risk Management. Retrieved from,
http://extensionrme.org/pubs/introductiontoriskmanagement.pdf
Srivastava, M., & Rogers, H. (2021). Managing global supply chain risks: effects of the industry sector. International Journal of
Logistics Research and Applications, 1-24.
Vijayan, V. K., & Sharma, D. (2020). Relationship Between Organizational Cultural Drivers and Risk Management Plan From
Enterprise Risk Management (Erm) Perspective–(a Study With Reference to the Projects Handled by It Companies in the
UAE). International Journal of Management, 11(5).
32
Extension rime. (2020). Introduction to Risk Management. Retrieved from,
http://extensionrme.org/pubs/introductiontoriskmanagement.pdf
Bushberg, J. T., Chou, C. K., Foster, K. R., Kavet, R., Maxson, D. P., Tell, R. A., & Ziskin, M. C. (2020). IEEE Committee on Man and
Radiation—COMAR Technical Information Statement: Health and Safety Issues Concerning Exposure of the General Public to Electromagnetic
Energy from 5G Wireless Communications Networks. Health Physics, 119(2), 236.
Carlton, M., Levy, Y., & Ramim, M. (2019). Mitigating Cyber-Attacks through the Measurement of Non-IT Professionals’ Cybersecurity
Skills. Information & Computer Security.
Cerdeira, D., Santos, N., Fonseca, P., & Pinto, S. (2020, May). Sok: Understanding the Prevailing Security Vulnerabilities in Trust Zone-Assisted
Tee Systems. In 2020 IEEE Symposium on Security and Privacy (SP) (Pp. 1416-1432). IEEE.
Dasgupta, K., Gibson, T., & Williams, M. (2021). Technological and Geographic Heterogeneity in Broadband Markets: The Challenge for
Regulation. Telecommunications Policy, 45(1), 102042.
Foster, K. R., Chou, C. K., & Petersen, R. C. (2018). Radiofrequency Exposure Standards. In Bioengineering and Biophysical Aspects of
Electromagnetic Fields (Pp. 463-511). CRC Press.
33
Javaid, N., Sher, A., Nasir, H., & Guizani, N. (2018). Intelligence in IoT-Based 5G Networks: Opportunities and Challenges. IEEE
Communications Magazine, 56(10), 94-100.
Obaidat, M. A., Obeidat, S., Holst, J., Al Hayajneh, A., & Brown, J. (2020). A Comprehensive and Systematic Survey on the Internet of Things:
Security and Privacy Challenges, Security Frameworks, Enabling Technologies, Threats, Vulnerabilities, and Countermeasures. Computers, 9(2),
44.
Shoebridge, M. (2018). Chinese Cyber Espionage and the National Security Risks Huawei Poses To 5G Networks. Macdonald-Laurier Institute
for Public Policy.
Varatharajan, R., Manogaran, G., Priyan, M. K., Balaş, V. E., & Barna, C. (2018). Visual Analysis of Geospatial Habitat Suitability Model Based
on Inverse Distance Weighting with Paired Comparison Analysis. Multimedia Tools and Applications, 77(14), 17573-17593.
Yan, F., Zhang, Q., Ye, S., & Ren, B. (2019). A Novel Hybrid Approach for Landslide Susceptibility Mapping Integrating Analytical Hierarchy
Process and Normalized Frequency Ratio Methods with the Cloud Model. Geomorphology, 327, 170-187.
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016). A Review of Cyber Security Risk
Assessment Methods for SCADA Systems. Computers & Security, 56, 1–27. https://doi.org/10.1016/j.cose.2015.09.009
Chochliouros, I. P., Spiliopoulou, A. S., Kostopoulos, A., Kourtis, M.-A., Lazaridis, P. I., Zaharis, Z. D., & Prasad, N. R. (2021).
Security Threat Analysis of the 5G Essence Platform. Wireless Personal Communications, 120(3), 2409–2426.
https://Doi.Org/10.1007/S11277-021-08554-5
34
Gandotra, P., & Jha, R. K. (2017). A Survey on Green Communication and Security Challenges in 5G Wireless Communication
Networks. Journal Of Network and Computer Applications, 96, 39–61. https://Doi.Org/10.1016/J.Jnca.2017.07.002
Radu, R., & Amon, C. (2021). The Governance Of 5G Infrastructure: Between Path Dependency and Risk-Based Approaches. Journal
Of Cybersecurity, 7(1), Tyab017.
Van Western, C. J. (2017). 5.5 Methods for Risk Assessment. CHARIM. http://Charim.Net/Methodology/55
35
36

Purchase answer to see full
attachment